I. BACKGROUND
The Netscape browser is a derivative of the Mozilla browser, an open
source webbrowser. More information is available from
http://browsers.netscape.com/.
II. DESCRIPTION
Improper input to the Javascript Function.thaw() method in Netscape and
Mozilla allows execution of arbitrary code.
The Function object's thaw() method contains an integer overflow which
allows exploitable heap corruption.
Additionally a user suppliable array index is not checked for validity,
which allows a pointer to be stored at an arbitrary index. A webpage can
be constructed to leverage this into execution of arbitrary code.
This issue was resolved by removal of the thaw() and freeze() methods
from the Function object in Mozilla 1.5, however there has not been a
new release of Netscape since the fix was made.
III. ANALYSIS
Successful exploitation allows the remote attacker to execute abitrary
code in the context of the user running the browser.
IV. DETECTION
DEFENSE has confirmed this vulnerability in Netscape 6.2.3, 7.0 and 7.1.
All versions from Netscape 6.0 upwards are vulnerable.
All versions of Mozilla prior to version 1.5 are also vulnerable.
V. WORKAROUNDS
Disabling Javascript will prevent exploitation of this vulnerability.
This may, however, reduce functionality of some sites.
VI. VENDOR FIX
Mozilla users should upgrade to the latest version.
A fix for Netscape is not available.
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0508 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
10/13/2003 Exploit acquired by iDEFENSE
10/19/2003 Initial vendor notification
12/22/2003 iDEFENSE Clients notified
12/29/2003 Public Disclosure
IX. CREDIT
zen-parse is credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
X. LEGAL NOTICES
Copyright © 2004 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
